docs: refresh REFERENCES.md (last touched 2026-03-23, pre-v3.0.0)

[Daren9m]

Background

REFERENCES.md was last touched 2026-03-23 (commit f60c2e4) — same v2.1.0 cohort as docs/CheckId-Guide.md (#400). Has had no v3.0.0 / v3.4.0 update.

Suggested review pass

• Verify all cited URLs still resolve (Microsoft Learn URL rot is documented in feat: remediation portal paths sweep + adopt Microsoft Learn URLs as canonical (rolling rot from MS UI reorgs) #362)
• Add v3.4.0 audit-catalog cross-references — each docs/audits/*.md cites authoritative sources that should also be linked here
• Add CIS SecureSuite license posture reference (LICENSES/CIS-CONSUMER-SIDE.md, v3.4.0 / feat: capture full CIS M365 v6 dataset per check (27 columns) #347 phase 2) since it materially affects what content the registry can carry
• Cross-link to SCF and confirm version (v3.0.0 release notes mention SCF 2025.4 — verify)

Acceptance

• All URLs resolve as of review date
• v3.0–v3.4 era authoritative sources included
• Section organized by topic (M365, Azure, frameworks, licensing) rather than chronologically appended